elfexec

Documentation

Overview

Package elfexec provides utility routines to examine ELF binaries.

Index

• func FindTextProgHeader(f *elf.File) *elf.ProgHeader
• func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, ...) (uint64, error)
• func GetBuildID(binary io.ReaderAt) ([]byte, error)
• func ProgramHeadersForMapping(f *elf.File, pgoff, memsz uint64) ([]*elf.ProgHeader, bool)
• type ElfNote
  • func ParseNotes(reader io.Reader, alignment int, order binary.ByteOrder) ([]ElfNote, error)

Functions

func FindTextProgHeader

func FindTextProgHeader(f *elf.File) *elf.ProgHeader

FindTextProgHeader finds the program segment header containing the .text section or nil if the segment cannot be found.

func GetBase

func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, start, limit, offset uint64) (uint64, error)

GetBase determines the base address to subtract from virtual address to get symbol table address. For an executable, the base is 0. Otherwise, it's a shared library, and the base is the address where the mapping starts. The kernel is special, and may use the address of the _stext symbol as the mmap start. _stext offset can be obtained with `nm vmlinux | grep _stext`

func GetBuildID

func GetBuildID(binary io.ReaderAt) ([]byte, error)

GetBuildID returns the GNU build-ID for an ELF binary.

If no build-ID was found but the binary was read without error, it returns (nil, nil).

func ProgramHeadersForMapping

func ProgramHeadersForMapping(f *elf.File, pgoff, memsz uint64) ([]*elf.ProgHeader, bool)

ProgramHeadersForMapping returns the loadable program segment headers that are fully contained in the runtime mapping with file offset pgoff and memory size memsz, and if the binary includes any loadable segments.

Types

type ElfNote

type ElfNote struct {
	Name string // Contents of the "name" field, omitting the trailing zero byte.
	Desc []byte // Contents of the "desc" field.
	Type uint32 // Contents of the "type" field.
}

ElfNote is the payload of a Note Section in an ELF file.

func ParseNotes

func ParseNotes(reader io.Reader, alignment int, order binary.ByteOrder) ([]ElfNote, error)

ParseNotes returns the notes from a SHT_NOTE section or PT_NOTE segment.